Privacy notice
Last updated: 11 October 2026
This notice explains what personal data I collect, why I collect it, how long I keep it, and what rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who is responsible for your data
SafeStaff is a trading name of Mike Slaiter, . I am the data controller for the personal data described here.
For anything about your data, email .
2. The short version
- I collect only what I need to sell and deliver the course and to answer your messages.
- I do not sell your data. I do not use advertising trackers or analytics on this website.
- Card payments are handled by Stripe. I never see or store your full card number.
- You can ask to see, correct or delete your data at any time.
3. What I collect, why, and for how long
| When | What | Why, and the lawful basis | Kept for |
|---|---|---|---|
| You visit this website | IP address, browser type, the pages requested, date and time. These are held in the web server's logs. | To run the site and keep it secure. Legitimate interests. | Up to 35 days. |
| Your browser loads the fonts | Your IP address is sent to Google, because the fonts on this site come from Google Fonts. | To show the site as designed. Legitimate interests. | Decided by Google. See Google's privacy policy. |
| You email me or use the contact form | Your name, email address, and whatever you write. If you choose to give them: your business name, phone number and number of staff. | To reply to you and, if you ask, to give you a price. Legitimate interests, or steps taken at your request before a contract. | Up to two years after our last contact. |
| You buy the course | Your name, business name, email address, billing address and a record of the order. Stripe processes your card details. | To take payment and give you access. Performance of a contract. I must also keep sales records for tax. Legal obligation. | Order records: at least five years after the 31 January that follows the tax year, as tax law requires. |
| You take the course | Your account login, the lessons you complete, quiz results, and your certificate with its date and reference. | To deliver the course, show your progress and issue your certificate. Performance of a contract. | While your account is open, and two years after it closes. |
| Your employer adds you as a learner | Your name and work email address, given to me by your employer. | To create your learner account. Legitimate interests of your employer and of me in delivering the course it bought. | As for “You take the course”. |
| You ask for updates by email | Your name and email address. | To send you news about the law and the course. Consent, or the PECR “soft opt-in” if you are a customer. Every email has an unsubscribe link. | Until you unsubscribe. |
4. Certificates
Each certificate has a verification link. Anyone who has that link can see the name on the certificate, the course name and the date. I do this so that a certificate can be checked. Share the link only with people you want to see it.
5. Sensitive information
I do not ask for special category data, such as information about health, sex life or sexual orientation. The course is about harassment law. Please do not send me details of a real incident or the names of the people involved. If you have a live complaint or claim, speak to an employment solicitor.
6. Who I share your data with
I use a small number of companies to run the business. They may only use your data to provide their service to me.
- Stripe, to take card payments.
- Resend, to send emails such as receipts, login links and course messages.
- IONOS, which provides the server that hosts this website, the learning platform and my mailbox. The server is in the European Union.
- Google, which serves the fonts.
- My accountant, HMRC, regulators or the courts, where the law requires it.
I do not sell or rent personal data to anyone.
7. Transfers outside the UK
Stripe, Resend and Google may process data outside the United Kingdom. Where they do, the transfer is covered by UK adequacy regulations or by the safeguards the Information Commissioner approves, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
8. Cookies
This website sets no cookies. The learning platform uses only the cookies it needs to work. The cookies page lists them.
9. How I protect your data
The website and the learning platform use encrypted connections (HTTPS). Access to customer records is limited to me and protected by a password. No system is perfectly secure. If a breach is likely to put your rights at risk, I will tell you and the Information Commissioner's Office as the law requires.
10. Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- ask me to correct data that is wrong or incomplete;
- ask me to delete your data, where the law allows;
- ask me to restrict how I use your data;
- object to my use of your data where I rely on legitimate interests, and object at any time to direct marketing;
- receive data you gave me in a portable format, where the basis is contract or consent;
- withdraw consent at any time, where I rely on consent.
I do not make decisions about you by automated means alone. To use any of these rights, email . I will reply within one month. There is no charge.
11. Complaints
If you are unhappy with how I have handled your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Children
This website and the course are for businesses and their staff. They are not aimed at anyone under 18, and I do not knowingly collect data from children.
13. Changes to this notice
I will update this page when the way I handle data changes. The date at the top shows the latest version.